Gestiona el riesgo de las grandes amenazas

©2012 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved.
Los Riesgos de
Nuevas amenazas
Mayo 2014

DDoS Attacks

3©2013 Check Point Software Technologies Ltd.
2001 20102005
Attack
Risk
Time© 2011, Radware, Ltd.
Blaster
2003
CodeRed
2001
Nimda
(Installed Trojan)
2001
Slammer
(Attacking SQL sites)
2003
Vandalism and Publicity
Storm
(Botnet)
2007
Agobot
(DoS Botnet)
Srizbi
(Botnet)
2007Rustock
(Botnet)
2007
Kracken
(Botnet)
2009
2010
IMDDOS
(Botnet)
Financially Motivated
Mar 2011 DDoS
Wordpress.com
Blending Motives
Mar 2011
Codero DDoS /
Twitter Israeli
sites
Google / Twitter
Attacks2009
Republican
website DoS
2004
Estonia’s Web Sites
DoS
2007
Georgia Web sites
DoS 2008
July 2009
Cyber Attacks
US & Korea
Dec 2010
Operation
Payback
Mar 2011
Netbot
DDoS
Mar 2011
Operation
Payback II
―Hacktivism‖
LulzSec
Sony, CIA, FBI
Peru,
Chile
2012
DDoS Timeline—Summary Graph
“Worms”
DDoS
“Blend”
DDoS Attacks Gaining Momentum

Application Layer
Attacks
Network Layer
Attacks
DDoS Attack by Types
More attacks are targeted at the application layer
TCP SYN
Flood

Layer 7 DoS Attacks
 Legitimate traffic
 Low bandwidth
 Exploit TCP protocol
 Partial HTTP Requests
 Recursive DNS Spoofing
 Application Exploits
 And more…
 Use of TOR
 Use of proxies
 Use of botnets
Allowed
Traffic
Hidden
Sources
Attack
Vectors
Attack
Damage

Attackers Use Multi-Layer DDoS
Large-volume network flood attacks
Web attacks:
brute force login locked
SYN flood attack
Application vulnerability
―Low and slow‖ DoS attacks
(e.g., Sockstress)
High and slow
application DoS attacks
Simultaneous Attack Vectors
1 successful attack vector = No service

DDoS and Traditional Security
Attackers Take Advantage of Traditional Security
 Routers may be affected
before firewalls
 Firewalls track state of network
connections (Can be bottleneck)
 Firewalls allow legitimate traffic
(e.g. port 80 to web server)
 IPS allows legitimate request
(e.g. get http/1.0rn)
 Application Control allows legitimate
services (DNS or HTTPS)

Traditional Firewalls Not Sufficient
Not Designed for Network and
Application DDoS Protection
 Basic rate based flood protection
affects all traffic
(Real users and attack traffic)
 Lacks Comprehensive Layer 7
DDoS protection
– Poor detection of sly attacks
– No filters to block attacks and
allow real traffic
– Administrators cannot create
custom signatures

What Software Blades Can Do
 Firewall configurations:
network access control
– Aggressive aging: protection against
connection-consuming attacks
– Network quota: limit number of
connections by source IP
– ICMP/UDP perimeter, initial drop rules:
drop early in policy
– Lower Stateful Inspection timers:
defense against slow attack
 IPS configurations: proactive intrusion prevention
– Geo protection: Rules to block by country and direction of traffic
– Worm catcher signature: block known worms (HTTP and CIFS)
– TCP window size enforcement: small TCP window and flood
– SYN flood protection: cookie-based validation
– HTTP flooding: rate-based blocking
 SmartEvent and SmartLog: improved visibility and forensics

Block Denial of Service Attacks within seconds!
Introducing Check Point
Check Point DDoS Protector™

Check Point DDoS Protector
Flexible
deployment
options
Customized
multi-layered
DDoS
protection
Fast
response
time—protect
within
seconds
DDoS Protector
Integrated
with Check
Point security
management

Product Information
Model DP 506 DP 1006 DP 2006 DP 3006 DP 4412 DP 8412 DP 12412
Capacity 0.5Gbps 1Gbps 2Gbps 3Gbps 4GBps 8Gbps 12Gbps
Max Concurrent
Sessions
2 Million 4 Million
Max DDoS
Flood Attack
Protection Rate
1 Million packets per second 10 Million packets per second
Latency <60 micro seconds
Real-time
signatures
Detect and protect against attacks in less than 18 seconds

DDoS Attack Information
Network Flood
High volume of
packets
Server Flood
High rate of
new sessions
Application
Web / DNS
connection-
based attacks
Low & Slow
Attacks
Advanced
attack
techniques

Network Flood
High volume of
packets
Server Flood
High rate of
new sessions
Application
Web / DNS
connection-
based attacks
Low & Slow
Attacks
Advanced
attack
techniques
Multi-Layer DDoS Protection
Behavioral
network
analysis
Stateless and
behavioral
engines
Automatic and
pre-defined
signatures
Protections
against misuse
of resources
Behavioral
HTTP and
DNS
Challenge /
response
mitigation
methods
Granular
custom filters
Create filters that
block attacks
and allow users

Flexible Deployment Options
Low Maintenance and Support
Optional Learning Mode Deployment
Fits to Existing Network Topology
Ready to Protect in Minutes
20©2012 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. |

+
Deployment Locations
On-Premise Deployment
DDoS Security Appliance
Off-Site Deployment
DDoS Security Appliance
Scenarios: 1 2 3
Transparent network device easily
fits into existing network topology
(layer 2 bridge)

Simple Deployment
Ready to protect any size network in minutes
1.Plug it in…
2.Let it learn…
3.Protected by
signatures
Signatures are
ready to protect
Baseline good
network and
application
behavior
No network
address changes
(Layer 2 bridge)

25©2013 Check Point Software Technologies Ltd.©2013 Check Point Software Technologies Ltd.
Zero Day & APTs

WOULD YOU OPEN
THIS ATTACHMENT?

TARGETED ATTACKS BEGIN
WITH ZERO-DAY EXPLOITS
Duqu Worm Causing Collateral Damage in a
Silent Cyber-War
Worm exploiting zero-day vulnerabilities in a Word document

Exploiting Zero-day vulnerabilities
New vulnerabilities Countless new variants
―nearly 200,000 new malware samples appear
around the world each day‖
- net-security.org, June 2013

WHAT ABOUT
NEW ATTACKS?
Block download of
malware infested files
Detect and prevent
bot damage
Stops exploits of
known vulnerabilities
Check Point Multi-Layered
Threat Prevention
IPS
Anti-Bot
Antivirus

Check Point introducing
Check Point ThreatCloud
Emulation Service
PREVENTION OF ZERO-DAY ATTACKS !

INSPECT
FILE
PREVENTSHARE
Stop undiscovered attacks with
Check Point Threat Emulation
INSPECT
FILE
EMULATE
PREVENTSHARE

Exe files, PDF and
Office documents
Identify files
in email
attachments
and downloads
over the web
Send file to
virtual sandbox
INSPECT
Requires no
infrastructure
change or
adding devices

EMULATE
Open file
and monitor
abnormal
behavior
Emulating
Multi OS
environments
WIN 7, 8, XP & user
customized
Monitored
behavior:
• file system
• system registry
• network connections
• system processes

A STANDARD CV?
Emulation @ Work

Emulation @ Work

Emulation @ Work
File System
Activity
System
Registry
System
Processes
Network
Connections
Abnormal file activity
Tampered system registry
Remote Connection to
Command & Control Sites
―Naive‖ processes created

PREVENT
Security
Gateway
Inline
stopping of
malicious
files on any
gateway

Immediate
update of all
gateways
SHARE

INSPECT
FILE
EMULATE
PREVENTSHARE
Stop undiscovered attacks with
ThreatCloud Emulation Service

New exploit variant of vulnerability
(CVE-2012-0158)
Installs a bot agent
Opens network ports for bot
communication
Steals user credentials
Real Life Example
Prevented 140 phishing emails
targeting 4 customers in 2 days!

Most Accurate and Fastest Prevention
Optimize analysis by
inspecting only files at risk
Zero false-positive in
document emulation
THREAT EMULATION with ongoing innovation

Branch
Headquarters
Branch
Agent for Exchange Server
ThreatCloud
Emulation Service
Single Global Solution –
For the entire organization

Specifications
Recommended # of
File scanning per Month
250,000 1,000,000
Recommended #
of users
1,700 7,000
Throughput (Mbps) 691 2032
Threat Emulation Private Cloud Appliance
Multiple deployment options:
Inline, Mail Transfer Agent, Tap

Advantages
Cloud based service—
works with your
existing infrastructure.
No need to install new
equipment
Control expenses with
manageable lower
monthly costs
Organizations can choose from
5 subscription options for global
file inspections, starting at
10,000 files per month and up

threats@checkpoint.com
threatemulation.checkpoint.com
Anyone can submit files for
THREAT EMULATION

Multi-Layered
Protection Against
all Incoming
Cyber Threats
Check Point Threat Prevention Solution

Top Reasons customers pick
Check Point Threat Emulation
works with your
existing infrastructure
-- No need to install
any new equipment
A Complete Threat
Prevention Solution
for Known and
Unknown threats

48©2013 Check Point Software Technologies Ltd.©2013 Check Point Software Technologies Ltd.
Compliance Software Blade
REVOLUTIONIZING
SECURITY & COMPLIANCE

Agenda
1 Market Background
Compliance Software Blade2
Extending GRC with easy2comply3
Compliance Customer Stories4
[Restricted] ONLY for designated groups and individuals
Summary5

As Security Pressures Grow…

… and Regulatory Compliance Needs Increase
MORE
MORE
MORE
Regulations
Frequent
Complex

Compliance Software Blade
Presenting:
Check Point’s first integrated and fully automated
Security & Compliance Monitoring

Security and Compliance Made Easy

Easy Installation:
Up and Running within
2Mouse Clicks
Fully Integrated Management Blade

Library of Security Best Practices

360 Security Visibility
Detailed Security Analysis

Detailed Security Analysis

ISO
27001
PCI-
DSS
GLBA
NIST
800-41
HIPAA
ISO
27002
Cobit
4.1
Complex Regulatory Requirements……mapped to Security Best Practices

Real-Time Assessment
of major regulations across Check Point Software Blades
Regulatory Compliance Monitoring

Out of the Box Audit Preparation

Real Time Security Alerts

Actionable Management

NOW IS THE TIME TO STREAMLINE SECURITY
WITH REGULATORY COMPLIANCE
 Real-Time Security Monitoring
 Compliance Reporting
 Security Alerts
 Complementary
GRC Solution
Summary

Gestiona el riesgo de las grandes amenazas

More Related Content

What's hot

Viewers also liked

Similar to Gestiona el riesgo de las grandes amenazas

More from Nextel S.A.

Recently uploaded

Gestiona el riesgo de las grandes amenazas

Editor's Notes